CVE-2026-97296 | High | 8.1 | 2026-10-16 | Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from… |
CVE-2026-104730 | Critical | 9.8 | 2026-10-16 | The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up… |
CVE-2026-104932 | High | 8.0 | 2026-10-16 | The Search Regex plugin for WordPress is vulnerable to PHP Object Injection in version 3.5 via deserialization of untrusted input in the replace_all function… |
CVE-2026-75941 | High | 8.0 | 2026-10-16 | A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allow an attacker on th… |
CVE-2026-47218 | | | 2026-10-15 | runwasi facilitates running Wasm and WASI workloads managed by containerd. Prior to 0.6.1, containerd-shim-wasmtime-v1 can treat Wasmtime precompiled bytes sup… |
CVE-2026-111160 | High | 7.5 | 2026-10-15 | LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal… |
CVE-2026-110874 | Medium | 6.6 | 2026-10-15 | Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restr… |
CVE-2026-110812 | Critical | 9.9 | 2026-10-15 | Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard d… |
CVE-2026-111094 | High | 8.1 | 2026-10-15 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible |
CVE-2026-47168 | Critical | 9.1 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated administrator can supply crafted serialized PHP object… |
CVE-2026-109686 | Critical | 9.8 | 2026-10-15 | Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free… |
CVE-2026-102469 | | | 2026-10-15 | In Eclipse Vert.x versions [4.0.0, 4.5.34] or [5.0.0,5.0.12] or [5.1.0,5.1.9] or [5.2.0, 5.2.0], the Vert.x DB2 client (vertx-db2-client) contains DRDA protoco… |
CVE-2026-110761 | High | 8.8 | 2026-10-14 | ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to des… |
CVE-2026-55573 | Critical | 9.8 | 2026-10-14 | e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unseriali… |
CVE-2026-97278 | High | 7.2 | 2026-10-14 | Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through 3.8.9. |
CVE-2026-108291 | Critical | 9.8 | 2026-10-14 | Deserialization of Untrusted Data vulnerability in itthinx Affiliates affiliates allows Object Injection.This issue affects Affiliates: from n/a through 7.0.1. |
CVE-2026-106599 | High | 8.8 | 2026-10-14 | Deserialization of Untrusted Data vulnerability in Brainstorm Force SureCart surecart allows Object Injection.This issue affects SureCart: from n/a through 4.9… |
CVE-2026-73793 | High | 7.9 | 2026-10-14 | HPE NonStop Middleware software has secret key handling and data deserialization vulnerability. |
CVE-2026-104764 | High | 7.2 | 2026-10-14 | The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization o… |
CVE-2026-93905 | High | 8.2 | 2026-10-13 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch j… |
CVE-2026-65674 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. |
CVE-2026-49950 | Critical | 9.8 | 2026-10-13 | Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending craft… |
CVE-2026-105442 | High | 7.5 | 2026-10-13 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker t… |
CVE-2026-96186 | High | 7.8 | 2026-10-13 | Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. |
CVE-2026-88091 | High | 7.8 | 2026-10-13 | Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. |
CVE-2026-87697 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-87692 | High | 7.8 | 2026-10-13 | Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. |
CVE-2026-85900 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-83520 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. |
CVE-2026-70035 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network. |
CVE-2026-105013 | High | 7.4 | 2026-10-13 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-100214 | High | 8.8 | 2026-10-13 | Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. |
CVE-2026-65180 | High | 7.8 | 2026-10-13 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciously crafted file. A… |
CVE-2026-65110 | High | 7.8 | 2026-10-13 | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where, an attacker could cause an RCE by convincing a user to load a maliciously crafted file… |
CVE-2026-108958 | Medium | 6.3 | 2026-10-13 | A weakness has been identified in TensorLayer up to 2.2.4. This affects the function load_hdf5_graph of the file tensorlayer/files/utils.py of the component HD… |
CVE-2026-108947 | Medium | 5.3 | 2026-10-13 | A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Execut… |
CVE-2026-109361 | High | 7.3 | 2026-10-12 | MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_i… |
CVE-2026-109360 | High | 7.5 | 2026-10-12 | MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weight… |
CVE-2026-109237 | High | 8.1 | 2026-10-12 | Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping t… |
CVE-2026-109391 | High | 8.1 | 2026-10-12 | Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POS… |
CVE-2026-12613 | High | 8.8 | 2026-10-12 | Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux… |
CVE-2026-52903 | High | 8.8 | 2026-10-12 | A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsa… |
CVE-2026-81797 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. |
CVE-2026-78535 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. |
CVE-2026-78533 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. |
CVE-2026-78531 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. |
CVE-2026-78529 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. |
CVE-2026-66569 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. |
CVE-2026-66568 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. |
CVE-2026-66567 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. |
CVE-2026-66565 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. |
CVE-2026-66564 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. |
CVE-2026-66563 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. |
CVE-2026-66483 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. |
CVE-2026-66482 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. |
CVE-2026-62130 | High | 7.2 | 2026-10-10 | Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions. |
CVE-2026-62125 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. |
CVE-2026-62124 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. |
CVE-2026-62123 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. |
CVE-2026-62120 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. |
CVE-2026-62090 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in WineShop <= 3.20 versions. |
CVE-2026-62087 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions. |
CVE-2026-62086 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Juno <= 2.25 versions. |
CVE-2026-62077 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions. |
CVE-2026-62076 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions. |
CVE-2026-62054 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. |
CVE-2026-62053 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. |
CVE-2026-62052 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. |
CVE-2026-62051 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. |
CVE-2026-62050 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. |
CVE-2026-62021 | High | 8.8 | 2026-10-10 | Subscriber PHP Object Injection in Angio <= 1.1.1 versions. |
CVE-2026-42723 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions. |
CVE-2026-42719 | Critical | 9.8 | 2026-10-10 | Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions. |
CVE-2026-42718 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions. |
CVE-2026-42716 | Critical | 9.8 | 2026-10-10 | Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions. |
CVE-2026-62044 | High | 7.2 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player… |
CVE-2026-104398 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injecti… |
CVE-2026-94676 | High | 7.2 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1… |
CVE-2026-105885 | High | 8.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through… |
CVE-2026-93945 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0. |
CVE-2026-93944 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15. |
CVE-2026-93943 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0. |
CVE-2026-93942 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0. |
CVE-2026-93941 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2. |
CVE-2026-93940 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0. |
CVE-2026-93938 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7. |
CVE-2026-93937 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0. |
CVE-2026-93936 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4. |
CVE-2026-93935 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through… |
CVE-2026-93934 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13. |
CVE-2026-93933 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1… |
CVE-2026-93932 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through… |
CVE-2026-93931 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0. |
CVE-2026-93930 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0. |
CVE-2026-93929 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.1… |
CVE-2026-93927 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0. |
CVE-2026-62046 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2… |
CVE-2026-62045 | Critical | 9.8 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through… |
CVE-2026-106606 | High | 7.2 | 2026-10-10 | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH… |
CVE-2026-12626 | High | 7.2 | 2026-10-10 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |